The session’s key takeaway was that robust crisis management requires a holistic approach, which includes integrating technical readiness, risk awareness and communication and relationship-building both internally and externally. Regular crisis exercises, redundancy in critical systems, and strong, trust-based partnerships are now indispensable, as even the most advanced organisations can be caught off guard by the speed and sophistication of modern attacks.

Technological vigilance, proactive crisis planning, and cross-functional collaboration are the way forward, according to Zelvin, McMorris, and Green. However, the situation at present is bleak. Zelvin describes “Asian fraud camps” and how techniques like pig butchering leads to people having their passports stolen or victims being shackled. “I do want to give you a sense of it as a crime that is happening not only to you,” Zelvin said.

He went on to explore how one of the challenges that security professionals like himself are having is that AI has “lowered the bar for what people need to do in order to commit these crimes.” Zelvin spoke about a conversation he had with the CEO of Pindrop Security Solutions, who he describes as having “one of the best AI protection capabilities I’ve ever seen. He told me that all it takes is about two or three seconds of your voice and a picture to make a full video deepfake.”

Zelvin went on to explain how he asked his team to make one of himself where he was saying “something a security professional would never say,” such as not worrying about password complexity. He shared that he showed his wife, and she did not notice that it was a deepfake. “By the way, it took me about $400, no experience, and hours to create these videos.”

Lessons learned from past crises McMorris provided insight into the challenges faced during the Silicon Valley Bank failure, which included moving funds and ensuring continuity for merchants and vendors. “It happened very quickly, very overnight, and we had to react,” McMorris said. Later, she explored how in the moment, Affirm – seeing that SVB was in distress - “pulled as much cash out of a few operating accounts that we had and stashed it somewhere else with a different bank so they could prepare for what was coming.” She continued: “We can’t receive consumer cheques. We couldn’t get our merchants paid. We couldn’t move any monthly credit. What were we supposed to do? We were lucky that we did have established planning partners that we were able to pick up and move services over to very quickly. [...] As far as our merchants and our vendors are concerned, we were contacting every single one of them on a one-by-one basis, asking: how do you guys want us to handle this?” McMorris highlighted that her biggest takeaway was the importance of having a diversified banking relationship and being able to pick up and pivot as needed. “That was critical for us, that we had an entity here, but we had that same entity elsewhere. That’s becoming a new standard for us as we start to grow. “We’re currently in Canada and the UK, and who knows where our CEO is going to take us next. But, we’re mimicking the structures so that we have two banks managing, overseeing one entity that gives me the flexibility, not only to pick and choose products and which bank in which area, but also to be able to make that quick pivot if I ever need to, heaven forbid we don’t have to do that again. Engineers will kill me, but if I must, we’re there and we’re ready to go.” Green added that “you must be prepared for anything and expect the unexpected. [...] You must be ready to react and put everything you can into it. You must step in with everything, and you’ve got to make sure that you have everything shored up and you have alternatives.”